wateroilclub[.]comDomain
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 6 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Group-IB unveils its Graph“The document contained a macros that launched powershell, which, in turn, tried to download and execute a file from hxxp://wateroilclub[.]com/file/dwm.exe in %Temp%einmrmdmy.exe.”
Indicators reported together
named in the same reports- 11.11.11[.]11in 1 report
- 22.22.22[.]22in 1 report
- 33.33.33[.]33in 1 report
- example[.]ruin 1 report
- secure-telemetry[.]netin 1 report
- ukrfreshnews[.]comin 1 report
- unian-search[.]comin 1 report
- vesti-world[.]infoin 1 report
- runewsmeta[.]comin 1 report
- foxnewsmeta[.]bizin 1 report
- sobesednik-meta[.]infoin 1 report
- rian-ua[.]netin 1 report
- themcx[.]coin 1 report
- phone-lookup[.]xyzin 1 report
- coinkeeper[.]ccin 1 report
- caller-record[.]sitein 1 report
- mcxwallet[.]coin 1 report
- phone-records[.]spacein 1 report
- btcnoise[.]comin 1 report
- fone-uncover[.]xyzin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.